Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

The Bytecode Alliance has fixed two sandbox-escape vulnerabilities in Wasmtime, the WebAssembly runtime embedded in other software, each rated 9.9 on CVSS. CVE-2026-115889 stems from a Cranelift bug that packed internal value-tracking numbers into 24-bit fields, allowing silent overflow and type confusion on any architecture when compiling very large or specially crafted functions; it was fixed upstream in Wasmtime 43 and backported to 36.0.19. CVE-2026-115893 affects only ARM64 hosts and involves the br_table instruction, where out-of-range indexes could trigger a branch beyond its reachable range, letting a malicious module redirect execution to arbitrary code — a flaw present since ARM64 support launched in 2020. Both require the attacker to control the compiled module, making platforms that run untrusted WebAssembly, like Fastly's Compute service, especially exposed; fixes landed in 36.0.19, 48.0.7, 49.0.4 and 50.0.0, with no known in-the-wild exploitation or CISA KEV listing as of October 26.